Characterizations of the Existence of Partial and Total 
One- Way Permutations 1 



Jorg Rothe 2 Lane A. Hemaspaandra 3 

Institut fur Informatik Department of Computer Science 
Friedrich-Schiller-Universitat Jena University of Rochester 

07743 Jena, Germany Rochester, NY 14627 

rothe @ informatik.uni-jena.de lane @ cs .rochester.edu 



'An extended abstract of this paper was presented at the Third Italian Conference on Algorithms and 
Complexity [ |HRW97| ], 

Supported in part by grant NSF-INT-9513368/DAAD-315-PRO-fo-aband by a NATO Postdoctoral Sci- 
ence Fellowship from the Deutscher Akademischer Austauschdienst ("Gemeinsames Hochschulsonderpro- 
gramm III von Bund und Landern"). Current address: Department of Computer Science, University of 
Rochester, Rochester, NY 14627, USA. Work done in part while visiting the University of Rochester and 
Le Moyne College. 

^Supported in part by grants NSF-INT-9513368/DAAD-315-PRO-fo-ab and NSF-CCR-9322513. Work 
done in part while visiting Friedrich-Schiller-Universitat Jena. 



Abstract 



In this note, we study the easy certificate classes introduced by Hemaspaandra, Rothe, 
and Wechsung [ ]HRW ], with regard to the question of whether or not surjective one- 
way functions exist. This is an important open question in cryptology. We show that 
the existence of partial one-way permutations can be characterized by separating P 
from the class of UP sets that, for all unambiguous polynomial-time Turing machines 
accepting them, always have easy (i.e., polynomial-time computable) certificates. This 
extends results of Grollmann and Selman [ GS88 ]. By Gradel's recent results about 
one-way functions [ Gra94 ], this also links statements about easy certificates of NP sets 
with statements in finite model theory. Similarly, there exist surjective poly-one one- 
way functions if and only if there is a set L in P such that not all FewP machines 
accepting L always have easy certificates. We also establish a condition necessary and 
sufficient for the existence of (total) one-way permutations. 



1 Introduction 

What makes NP-complete problems intractable? One possible source of their potential intractability 
is the fact that there are many possible sets of solutions: The search space is exponential so the cardi- 
nality of the set of sets of solutions is double-exponential in the input size. Another possible source 
of NP's complexity is that all solutions (even if there are just a few of them) may be random in the 
sense of Kolmogorov complexity and thus hard to find. For both reasons one may try to "remove" 
the difficulty from NP by considering subclasses of NP that, by definition, contain only easy sets 



with respect to either type of difficulty. NP's subclasses UP (unambiguous polynomial time) QVal76| ] 



and FewP (ambiguity-bounded polynomial time) [ A1186, AR88] both implicitly reduce the richness 



of the class of potential solutions to 2 n ° 1 . To single out those NP sets that, for all NP machines 
accepting them, have easy solutions — i.e., solutions of small Kolmogorov complexity — for all in- 



stances in the set, Hemaspaandra, Rothe, and Wechsung [HRWj defined the class EASYy (see the 



next section for precise definitions). Interestingly, both these concepts of easy NP sets (to wit, UP 
and EASYy) have their own connection to the invertibility of certain types of one-way functions, as 
will be stated below. Intuitively, a one-way function is a function that is easy to compute but hard to 
invert. One-way functions play a central role in complexity-theoretic cryptography [ pS88 ], where 



the open question of whether such functions do or do not exist is of central importance. 

It is well-known that many-one one-way functions exist if and only if P ^ NP. Thus, we cannot 
hope for an ultimate solution to the question of whether or not one-way functions exist unless we 

can solve the famous P = NP question. All we can hope for is to characterize the existence of 
certain special types of one-way functions via complexity-theoretic statements such as the collapse 
or separation of the corresponding complexity classes. Many types of one-way functions have been 
studied in the literature. Most notable among such results is Grollmann and Selman's characteriza- 
tion of the existence of certain types of injective one-way functions by conditions such as P ^ UP 
or P 7^ UP (~l coUP [ GS88 ] (see also jKo85| ]). Allender extended their results by proving that poly- 



one one-way functions exist if and only if P ^ FewP [ A1186]. Watanabe showed that constant-one 
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one-way functions exist if and only if injective one-way functions exist [Wat88], notwithstanding 
the fact that even at the level of constant injectivity it has been shown [HH94] that greater injectivity 
yields strictly more general reductions. Watanabe also showed that the existence of randomized in- 
jective one-way functions and the existence of extensible injective one-way functions, respectively, 
can be characterized by the separations BPP 7^ UP BPP and V ^ IAV [ |Wat92 ], where BPP denotes 
bounded probabilistic polynomial time [ 3il77], V is the class of polynomial-time solvable promise 
problems (in the sense of QEY80| , |ESY84j |GS88| ], see also QHR97M ), and UV is the class of un- 
ambiguous promise problems. Finally, Fenner et al. [pFNR96| ] proved the existence of surjective 
many-one one-way functions equivalent to P <2 EASY^ 

In this note, a characterization of the existence of injective and surjective one-way functions is 
given by separating P from a class, denoted EASYy(UP), which combines the restriction of unam- 
biguous computation with the constraint required by EASYy. Thus, EASYy(UP) simultaneously 
reduces the solution space of NP problems to at most one solution and requires that this one solution 
can be found and printed out in polynomial time, if it exists. Furthermore, the existence of surjec- 
tive poly-one one-way functions is shown to be equivalent to the separation of P and EASYy(FewP) 
(which is the polynomially ambiguity-bounded analog of EASYy(UP)). Our work is connected to 
the seemingly unrelated field of (finite model) logic; from Gradel's | ]Gra94p recent results about one- 
way functions, we obtain as a corollary equivalences between statements about easy certificates of 
NP sets and statements in finite model theory such as that the weak definability principle in a logic 
on finite structures fails to hold. In addition, based on Selman's analogous observation for EASYy 
(as cited in [HRW]), further characterizations of the existence of surjective one-way functions are 
provided in terms of the question of whether EASYy(UP) and EASYy(FewP) are closed under 
complementation. Finally, we show that the existence of total injective one-way functions with a 
P-rankable range is a condition necessary and sufficient for the existence of one-way permutations. 



2 Preliminaries 

All sets considered are subsets of £*, where £ = {0, 1}. Functions map from S* to S* and are 
many-one and partial (unless explicitly specified to be one-one or total). The length of a string 
x € X* is denoted by \x\ and the cardinality of a set L C £* by ||L||. Let e denote the empty string. 
Let (-, ■) be a standard easily computable pairing function (i.e., a bijection between S* x S* and £*) 
that can be extended to encode tuples of strings by one string as usual. Let <i ex denote the standard 
quasi-lexicographical ordering on S*. For each (single- valued, partial or total) function / : S* — > 
£*, let dom(/) and range(/) denote the domain and range of /, respectively. 

Let NPM be a shorthand for "nondeterministic polynomial-time Turing machine." For each 
NPM M, L(M) denotes the language accepted by M. For each NPM M and any input x, we 
denote the set of accepting paths of M{x) by hccm{x). An NPM M is a UP machine (FewP 
machine, respectively) if, for all inputs x, M(x) has at most one (at most polynomially in \x\, 
respectively) accepting paths, and M accepts x if and only if M(x) has at least one accepting path. 
UP JVal7^ ] (respectively, FewP [ |A1186| , |AR88p ) is the class of sets L such that L = L(M) for some 



UP machine (FewP machine) M. FP denotes the class of polynomial-time computable functions. 



EASYy []HRWp is defined to be the class of all sets L for which all NPMs accepting L always (i.e., 
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on all inputs x G L) have easy certificates (i.e., accepting paths whose encoding can be printed 
in polynomial time). Of the four classes EASYy, EASY^,, EASYy, and EASY? considered by 
Hemaspaandra, Rothe, and Wechsung [HRW], only EASYy is relevant for the characterization of 



one-way functions. 

Now let us formally define the UP and FewP analog of EASYy. Though it is clear that a more 
general definition of the form EASYy(C, J 7 ) for complexity classes C other than NP, UP, or FewP 
and for function classes T other than FP can analogously be obtained, we will only define the classes 
of interest here. 

Definition 2.1 For C G {NP, UP, FewP}, define EASY^(C) to be the class of all sets L that either 
are finite, or that satisfy (a) L G C, and (b) for every C-machine N such that L(N) = L, there exists 
an FP function /at such that, for all x G L, /n(x) G accAr(x). 

The inclusions summarized in Proposition [Z2| below follow immediately from the definition. 
For instance, the inclusion EASYy C EASYy(FewP) holds, since each EASY^ set L is in r 



(see [HRW, Figure 1]) and thus in FewP, and moreover since if every NPM accepting L always 
has easy certificates, then so does every FewP machine. The inclusion EASYy(UP) C P holds due 



to EASY^(UP) C EASY^(UP) = EASY^ = P (see [HRW, Theorem 2.2.1]), where EASY^(UP) 



denotes the analog of EASYy(UP) such that condition (b) in Definition |2. l| above is required to hold 
only for some UP machine N. 

Proposition 2.2 EASY^ C EASY^(FewP) C EASY^(UP) CPC UP C FewP C NP. 

Next, we define the types of one-way functions considered in this paper. Note that the honesty 
of one-way functions is required in order to avoid the case that the FP-noninvertibility is trivial. 

Definition 2.3 1. A function / is honest if there is a polynomial p such that for every y G 
range(/) and for every x G dom(/), if y = f{x) then \x\ < p(\y\). 

2. A function / is poly-one if there is a polynomial p such that < p(\y\) for each 
y G range(/). 

3. A (many-one) function / is said to be FP-invertible if there is a function g G FP such that 
for every y G range (/), g(y) prints some value of f~ 1 {y)- In particular, if / is one-one, 
FP-invertibility of / means f~ x G FP. 

4. A function / is said to be a one-one (respectively, poly-one, many-one) one-way function if 
/ is honest, one-one (respectively, poly-one, many-one), / G FP, and / is not FP-invertible. 
If / : S* — > X* is a total, surjective, and one-one one-way function, / is called a one-way 
permutation. 

Sometimes the following weaker definition of honesty is used: / is honest if there is a poly- 
nomial p such that for every y G range(/) there is a string x G dom(/) such that y = f(x) and 
\x\ < p(\y\)- All claims in this paper, except those involving weak one-way functions (defined 
later), hold also for this alternate definition. 
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Note that we discuss one-way functions in the complexity-theoretic setting introduced by Groll- 
mann and Selman [ GS88 ]. So-called cryptographic one-way functions are not discussed here, 
though we should mention that one-way permutations have been interestingly studied in that con- 
text [|Yao82|, |IR89l |HILL91p. 



3 Characterizing the Existence of Surjective One- Way Functions 



Fenner et al. QFFNR96H have characterized the existence of surjective many-one one-way functions 
by the condition P <2 EASYy. In this section, we give analogous characterizations of the existence 
of surjective one-one one-way functions and surjective poly-one one-way functions by separating P 
from EASYy(UP) and EASYy(FewP), respectively. We mention here that there is a relativization 
in which P % EASY^ does not imply P ^ NP n coNP ( |N88| ], see also JCS93| , |FR94l , pFNR96| ]). 



We begin with the characterization of the existence of surjective one-one one-way functions. 
Note that the type of function discussed in item (2) of Theorem |3j] below is the partial-function 
analog of a (total) one-way permutation. Note also that the equivalence of statements (1), (3), 
and (4) in Theorem holds in analogy to the case of EASY^ (see jHRWj , pFNR96| ]). 



Theorem 3.1 The following are equivalent. 

1. EASY^(UP) + P. 

2. There exists a partial one-one one-way function / with range(/) = £*. 

3. £* EASY^(UP). 

4. EASYy (UP) is not closed under complementation. 

Proof. Clearly, (3) implies (4), since S* = as a finite set is in EASYy (UP). (4) immediately 
implies (1). To see that (1) implies (3), assume there is a set L G P such that L €" EASYy(UP). Let 
N be some UP machine accepting L such that no FP function exists that outputs the accepting path 
of N(x) for all inputs x G L. Let M be some P machine that accepts L. Consider the following 
NPM N': On input x, N' guesses whether x G L or x G L. If the guess was "x G L," N' 
simulates N(x); otherwise, it simulates M(x). Then, N' is a UP machine accepting E*. Note 
that the accepting computation of N'(x) for inputs x G L contains the accepting computation 
of N(x). Since L cannot be empty (in fact, L cannot be finite, for otherwise we would have had 
L G EASYy(UP)), no FP function can output, for all inputs x G £*, the accepting path of N'(x). 
Hence, S* 0EASY^(UP). 

(3) implies (2): Assume S* EASYy(UP). Let M be a UP machine accepting S* such that no 
FP function can output the accepting path of M(y) for all y G S*. For any input y, let comp M (y) 



denote the unique accepting path (encoded as a sequence of configurations) of M (y). As in [3S88], 
define the function / to be 

f( x )^l y ^ x = comp M (y) 
\ _L otherwise, 
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where _L is a special symbol indicating, in the usage "f(x) = JL," that / on x is not defined. 
Clearly, given x, it can be checked in polynomial time whether x encodes an accepting path of M 
(by checking whether it starts with the initial configuration of M for some input string, all transitions 
from one configuration to the next are legal, and the final configuration contains an accepting final 
state), and if so, the input string y of M can easily be determined. Thus, / E FP. Since M is a 
UP machine, / is injective. The polynomial bounding the running time of M witnesses the honesty 
of /. Since L(M) = £*, / is surjective. Finally, / _1 FP, since f~ l {y) = x is an accepting 
computation of M(y) for each y, and so f^ 1 £ FP contradicts our assumption that M only has hard 
certificates. To summarize, / is a partial one-one one-way function with range (/) = E*. 

(2) implies (3): Let / be a partial one-one one-way function with range(/) = £*. We will show 
that range(/) = S* is not in EASYy(UP). Let p be the polynomial that witnesses the honesty of /. 
Consider the following machine M. On input y, M nondeterministically guesses all strings x of 
length at most computes /(a?) for each guessed x, and accepts y if and only if f(x) = y. 

Clearly, M is a UP machine accepting £*, since / is a p-honest bijection (from some subset of 
S* onto £*) computable in polynomial time. Since f^ 1 FP and the accepting path of M(y) 
contains x = f~ 1 (y), no FP function can output, for all y, the accepting path of M on input y. 
Thus, S* EASY^(UP). □ 

By Grollmann and Selman's characterization of the existence of partial one-one one-way func- 
tions with range(/) = £* [ GS88| ], we immediately have Corollary 3.2, which has previously been 
proven directly by Hartmanis and Hemaspaandra (then Hemachandra) [ HH88 ], using different no- 



tation. As a point of interest, we note that Corollary 3.2 proves that separating P from a certain 
class containing P is equivalent to separating P from a certain class contained in P. Also, though 
Naor and Impagliazzo JN88| , Proposition 4.2] (see also [ ]CS93| , |FR94| , |FFNR96| |) have shown that 
for the converse of the original (i.e., NP) version of the Borodin-Demers [ BD76 ] theorem^] there is 



a relativized counterexample, Corollary 3.2 says that the converse of the UP analog of the Borodin- 



Demers theorem holds (see [HH88] for discussion of this point) 



Corollary 3.2 [gH8|] P ^ UP n coUP if and only if EASY^(UP) / P. 



A seemingly unrelated connection comes from finite model theory. Gradel [Gra94] has recently 
shown that P = UP n coUP if and only if the weak definability principle holds for every first 
order logic C on finite structures that captures P. The weak definability principle says: Every totally 
defined query (on the set of finite structures of the relations of a first order logic C) that is implicitly 



definable in C is also explicitly definable in C (see [ Gra94 ] for those notions not defined here) 



Corollary 3.3 EASYy(UP) ^ P if and only if the weak definability principle fails for some first 
order logic £ on finite structures that captures P. 



Fenner et al. [ ]FFNR96 ] also consider the "one-bit version" of the condition S* € EASYy. Let 
us define l-EASYy(C) to be the class of all sets L that either are finite, or that satisfy (a) L G C, 
and (b) for every C-machine N such that L(N) = L, there exists an FP function /jy such that, for all 

'Which says P ^ NP n coNP implies EASYy 7^ P, except it states this in a different but equivalent form. 
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x G L, /jv(x) outputs the first bit of an ("the" in the case C = UP) accepting path of N(x). Clearly 
(as in the case of NP), we have for the UP case: (a) P = EASY^(UP) implies P = l-EASY^(UP), 
and (b) P = l-EASY^(UP) implies P = UP n coUP. Thus, Corollary in fact can be restated as 
Corollary [^4], which sharply contrasts with the NP case QIN88| , |FR94j |FFNR96p , i.e., even though 



P = EASYy, P = 1-EASYy, and P = NP n coNP appear to be pairwise different conditions, their 
UP variants behave equivalently, and thus it is not reasonable to consider a "one-bit version" of 
EASY^(UP). 



Corollary 3.4 (see also pH88| ]) The collapses P = EASY^(UP), P = l-EASY^(UP), and 



P = UP n coUP are pairwise equivalent. 



Now we characterize the existence of surjective poly-one one-way functions by separating P 



and EASY^(FewP). 



Theorem 3.5 The following are equivalent. 

1 . There exists a partial surjective poly-one one-way function. 

2. There exists a total surjective poly-one one-way function. 

3. There exists a total poly-one one-way function / with range(/) G P. 

4. There exists a partial poly-one one-way function / with range(/) £ P. 

5. EASY^(FewP) / P. 

6. £* EASY^(FewP). 

7. EASYy(FewP) is not closed under complementation. 

Proof. Clearly, (1) implies (3), as if / is a function satisfying (1), then 

df f 0/(x) i£f(x)^l 



g{x) 



lx if f(x) = _L 



satisfies (3). Also, (3) trivially implies (4). 

(4) implies (5): Let / be a partial poly-one one-way function with range(/) in P. We will show 
that range(/) is not in EASYy(FewP). Let p be the polynomial that witnesses the honesty of /. 
Consider the following machine M. On input y, M nondeterministically guesses all strings x of 
length at most p(|y|), computes f(x) for each guessed x, and accepts y if and only if f(x) = y. 
Clearly, M is a FewP machine accepting range (/), since / is a p-honest poly-one function com- 
putable in polynomial time. Since / is not FP-invertible and each accepting path of M(y) contains 
some value of f^ 1 (y), no FP function can output, for all y, some accepting path of M on input y. 
Thus, range(/) EASY^(FewP). 
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It is clear that (2) implies (1). Suppose (1) holds, 
function satisfying (2), where 



and / is a function satisfying (1). Then /' is a 



df 



e 


if x 


= e 


mo 


if x 


= zO and /(z) ^ _L 


zl 


if x 


= zO and /(z) = _L 


zl 


if x 


= zl. 



The proof that conditions (5), (6), and (7) of this theorem are pairwise equivalent goes through 



as in the proof of the corresponding claim for EASYy or EASYy(UP) (see Theorem |3T| ). Finally, 



that (7) implies (1) can again be seen as in the proof of Theorem |3JJ, the only difference being that 
M now is a FewP machine accepting S* and the function / is now defined by f(x) = y if x is some 
accepting path of M(y), and f(x) is undefined otherwise. Then, / is a partial surjective poly-one 
one-way function. This completes the proof that all statements of the theorem are equivalent. □ 



Note that P ^ FewP is clearly implied by each of the conditions of Theorem 3.5. Note also that 
P ^ FewP n coFewP clearly implies each of the conditions of Theorem [3.5[ though it is not known 
whether the converse holds. We conjecture that it does not (equivalently, we conjecture that the 
converse of the FewP analog of the Borodin-Demers theorem does not hold). Thus, the conditions 
of Theorem 3^ are intermediate between the conditions P ^ FewP n coFewP and P ^ FewP.^ 

Could it be the case that the conditions of Theorem [T5] in fact either are equivalent to P / 
FewP n coFewP, or are equivalent to P ^ FewP? Relativized counterexamples are known for each 



of these cases. In particular, there is a relativized world, constructed by Fortnow and Rogers [ ]FR94fl , 



in which the conditions of Theorem 3.5 fail yet P ^ FewP holds. Also, Lance Fortnow [ For97 ] has 



informed us that, using the techniques of Fortnow and Rogers QFR94| ], one can build a relativized 
world in which in which P = FewP n coFewP yet the conditions of Theorem 3.5 hold. 



2 Regarding the condition P 7^ FewP, Allender [A118(] showed that the following conditions are all equivalent: 
(a) P 7^ FewP, (b) there exists a total poly-one one-way function, and (c) there exists a total poly-one weak one-way 
function. Weak one-way functions mean the following. A poly-one function / is strongly FP-invertible if there is a 
function g G FP such that for every y G range(/), g(y) prints all elements of f~ 1 (y)- A function / is called a weak 
one-way function if / € FP, / is poly-one, / is honest, and / is not strongly FP-invertible. 

Similarly, it is not hard to see, e.g., from Allender's proof, that also equivalent to (a), (b), and (c) are each of these 
conditions: (d) there exists a total poly-one weak one-way function / with range(/) £ P, and (e) there exists a partial 
poly-one one-way function. 

We note that the following condition is also equivalent to each of (a)-(e): (f) there exists a total surjective poly-one 
weak one-way function. This is true for the following reasons. Clearly (f) implies (d). Also, (e) implies (f) as if h is a 
function satisfying (e), then h! satisfies (f), where 



h'{x) 



df 



e ifze{e,0, 1} 

h(z)0 if x = zOO and h(z) _L 

zl if (x = zOO A h(z) = _L) or x 

zO if x = zOl or x = 2IO. 



zll 
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4 Characterizing the Existence of One-Way Permutations 



For many types of one-way functions, the existence question has been characterized in the literature 
as equivalent to the separation of suitable complexity classes. Such a characterization for the exis- 
tence of one-way permutations, however, is still missing. To date, the result closest to this goal is 
the above-mentioned characterization of the existence of a partial, injective, and surjective one-way 
function / by the condition P ^ UP n coUP [ GS88| ].P| Since / is not total, / is not a permutation 



of E* (even though / is a bijection mapping a subset of S* onto £*). Thus, P 7^ UP n coUP 
potentially is a strictly weaker condition than the existence of a one-way permutation. Of course, 



such a function / can be made total [GS88], but only at the cost of loss of surjectivity (even though 
such a total one-way function created from / still has a range in P). However, we will show below 
that the existence of one-way permutations is equivalent to the existence of total injective one-way 
functions whose range is P-rankable. 



Definition 4.1 [ pS91| ] A set A is said to be P-rankable if there exists a polynomial-time com- 
putable function rank so that (Vx G S*) [rank(x) = \\A- lcxX \\], where A- lexX denotes the set of all 
strings w G A with w <i ex x. 

That is, a ranking function for A tells us the number of strings in A up to a given string. To avoid 



confusion, we mention that the notion of P-rankability used here (and in [GS91]) is also sometimes 
referred to as "strong P-rankability" (e.g., in [ HR90| ]). 



Theorem 4.2 One-way permutations exist if and only if there exist total one-one one-way functions 
whose range is P-rankable. 

Proof. The "only if" direction is immediate, since S* is P-rankable. 

For the converse, suppose there exists a total one-one one-way function / whose range is P- 
rankable. We will define a one-way permutation h. Intuitively, the idea is to fill in the holes in the 

range of /, using its P-rankability. Let T = range (/) be P-rankable. For each n, let holes (n) = 
2 n — \\T =n || . Note that since T is P-rankable, holes is in FP. Let us introduce some useful notation. 
For each string x, let k{x) be the lexicographical position of x among the length |x| strings; e.g., 
£;(000) = 1 and fc(lll) = 8. For each string x and each j G IN, let x — j denote the string that in 
lexicographical order comes j places before x. For each set A and each k G IN, let Aru be the kth 
string of A in lexicographical order. Now define the function h by 

, , , df j f(x — Y^o^°^ es (^)) if k(x) > holes (\x\) 
[X) ~ j (fnEH)^] if k(x)< holes (\x\). 

Since T is P-rankable and / G FP, we have h G FP. Clearly, h is honest and injective, h is total, and 
range(/i) = E*. If one could invert h in polynomial time, then / would also be FP-invertible, as the 



3t 



Fenner et al. |FFNR96|| make the following claim: If P = 1-EASYy, then there exist no one-way permutations 



However, since P = 1-EASYy implies P = UP PI coUP, the following also correct claim is stronger: If P = UP n coUP, 
then there exist no one-way permutations. The difficult part seems to be the converse implication, and we conjecture that 
the converse does not hold. 
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Partial functions 


one-one 


poly-one 


no restriction 


P / UP [GS88] 


P ^ FewP (Footnote 2) 


surjective 


P / EASY^(UP) (Thm. 3.1) 


P / EASY^(FewP) (Thm. 


3.5 


1 


range in P 


P / EASY^(UP) (Thm. |3T plus [|GS88|, Theorem 8]) 


P ^ EASY^(FewP) (Thm. 


3.5 


1 



Table 1: Characterizations of the existence of various types of one-way functions: the partial func- 
tion case. 



Total functions 


one-one 


poly-one 


no restriction 


P / UP [pS88| 


P ^ FewP |]A1186|] 


surjective 


open question (but note Thm. 


4.2) 


P ^ EASY^(FewP) (Thm. 


3.5 


) 


range in P 


P ^ EASY^(UP) (Thm. 


3.1 


plus [ 


GS88 


, Theorem 8]) 


P ^EASY^(FewP) (Thm. 


3.5 


) 


weak 


P ^ UP [ 


GS88 




P ^ FewP [A1186] 


surj. & weak 


open question (but note Thm. 4.2|) 


P ^ FewP (Footnote |2 




P-range & weak 


P ^ EASYv(UP) (Thm. 


3.1 


plus [GS88 


, Theorem 8]) 


P ^ FewP (Footnote p 





Table 2: Characterizations of the existence of various types of one-way functions: the total function 
case. 



P-rankability of T allows one to find the string in the range of / that should be inverted with respect 
to h, and after inverting we shift the inverse with respect to h, say z, by Yl\=o holes{i) positions to 
obtain the true inverse with respect to /. Hence, h is a one-way permutation. □ 



Note that P-rankability of the range of / suffices to give us Theorem 4.2, and Theorem 4.2 is 
stated in this way. However, even weaker notions would work. Without going into precise details, 
we remark that one just needs a function that, from some easily found and countable set of places, 



is an honest address function (see [ pHK92| ]) for the complement of the range of /. Of course, the 
ultimate goal is to find a characterization of the existence of one-way permutations in terms of a 
separation of suitable complexity classes. 

Finally, Tables [I] and |2| summarize the characterization results that are known from the literature 
and from this paper. Note that for one-one functions, FP-invertibility and strong FP-invertibility are 
clearly identical notions, and so the one-one column of Tables [I] and || is not affected by the "weak" 
issue. 
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